019b1767e76539b91fdb7f3feb76457f8ca509dec83bbb0ecddbe49139da25a3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 01:02

Target

019b1767e76539b91fdb7f3feb76457f8ca509dec83bbb0ecddbe49139da25a3.exe
Size

111KB
MD5

a45459f165bc4fe6000f101b77674b67
SHA1

9c1bbbaa037f961d6d856d31138cdc2a76c4ab64
SHA256

019b1767e76539b91fdb7f3feb76457f8ca509dec83bbb0ecddbe49139da25a3
SHA512

652605732a92c4481a26c1f9fbf7eb6e27bd695e6b8cd574c26259107e4d17a29226afc07a4dec4fedcb9d179abc2c42690c9d6b673da550c73f7ee21868ac9b
SSDEEP

1536:jW89sVhmEttxuecocrdfLo6hskY1FM0AfAy8I2wwSvRn8mKH5ISCNftg:q8iVffcocrdfLo6hRYPgfAZI2DSZ8E

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	308	019b1767e76539b91fdb7f3feb76457f8ca509dec83bbb0ecddbe49139da25a3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 2176	308	019b1767e76539b91fdb7f3feb76457f8ca509dec83bbb0ecddbe49139da25a3.exe	28
PID 308 wrote to memory of 2176	308	019b1767e76539b91fdb7f3feb76457f8ca509dec83bbb0ecddbe49139da25a3.exe	28
PID 308 wrote to memory of 2176	308	019b1767e76539b91fdb7f3feb76457f8ca509dec83bbb0ecddbe49139da25a3.exe	28

C:\Users\Admin\AppData\Local\Temp\019b1767e76539b91fdb7f3feb76457f8ca509dec83bbb0ecddbe49139da25a3.exe
"C:\Users\Admin\AppData\Local\Temp\019b1767e76539b91fdb7f3feb76457f8ca509dec83bbb0ecddbe49139da25a3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:308
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 308 -s 864
  2⤵
  PID:2176

memory/308-0-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download
memory/308-1-0x0000000000FD0000-0x0000000000FF0000-memory.dmp

Filesize
128KB

Download
memory/308-2-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/308-3-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download
memory/308-4-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download